Red Balloon Security, the market leader in the "Defend from Within" approach to embedded firmware security, announced today the commercialization of OFRAK with support from the Defense Advanced Research Projects Agency (DARPA), which includes $310,000 of non-dilutive funding by the DARPA Embedded Entrepreneurship Initiative (EEI).
NEW YORK, June 5, 2024 /PRNewswire-PRWeb/ -- Red Balloon Security, the market leader in the "Defend from Within" approach to embedded firmware security, announced today the commercialization of OFRAK with support from the Defense Advanced Research Projects Agency (DARPA), which includes $310,000 of non-dilutive funding by the DARPA Embedded Entrepreneurship Initiative (EEI). This award raises Red Balloon Security's total DARPA funding to $22.4 million since 2013. OFRAK is a DevOps tool that enables advanced binary analysis and hardening, supporting engineers to enhance device security at the binary-level. For analysis, OFRAK allows for identification and unpacking of many binary formats leveraging field-tested reverse engineering tools. For hardening, OFRAK is utilized in the firmware build process to apply defensive techniques into existing binaries, including runtime integrity protection and attack surface reduction. DARPA's EEI award will help Red Balloon Security to bring these capabilities directly to commercial device manufacturers and the Defense Industrial Base (DIB) to secure their embedded devices. The award will support go-to-market activities which include executing a marketing strategy and conducting customer outreach. Red Balloon Security has also been a performer on DARPA's Assured Micropatching (AMP) program which has helped shape the development of OFRAK.
"OFRAK places in the hands of regular developers and engineers entirely new capabilities for firmware maintenance and sustainment, including the ability to create assured security fixes within days," said Sergey Bratus, Dartmouth College Distinguished Professor, and former DARPA Program Manager for the Information Innovation Office (2018-2024). "Previously, these capabilities were commanded only by small boutique reverse engineering teams, and the fixes took months to accomplish and test. The OFRAK Graphical User Interface (GUI) reduces the reverse engineering learning curve for those with little or no experience, while its Python Application Programming Interface (API) provides a rich toolset for power users."
In modern infrastructure, embedded devices are at the intersection of incredible value and escalating threat. Microsoft's March 2021 Security Signals report found that "Firmware, which lives below the operating system, is emerging as a primary target because it is where sensitive information like credentials and encryption keys are stored in memory. Many devices in the market today don't offer visibility into that layer to ensure that attackers haven't compromised a device prior to the boot process or at runtime below the kernel. And attackers have noticed."
"Through our work with DARPA, we've found that the vast majority of embedded systems have inherent vulnerabilities. To provide the highest level of security, OFRAK was designed to work on fielded binaries, without access to source code, to harden and insert monitoring into device firmware" said Dr. Ang Cui, Founder and CEO of Red Balloon Security. "We're excited to bring OFRAK and the 'Defend from Within' approach to the wider commercial market as a competitive advantage for our customers."
OFRAK key features:
- Identify, Unpack, and Analyze Binaries: of many file formats (e.g., ELF executables, filesystem archives, compressed data)
- Modify and Repack Binaries: automatically, as well as update and patch compiled binaries faster to mitigate vulnerabilities
- Reduce Attack Surface: by removing unwanted features and unused code/data (e.g., Bluetooth, WiFi, NFC)
- Randomize Binary Layouts: at the basic block level to increase the difficulty of an attacker trying to launch an attack, as well as expand the window for your customers to react to vulnerabilities
- Harden Binaries with Runtime Monitoring: Integrate defensive software payloads directly into binaries to monitor against attacks targeting corruption or compromise of device memory, control-flow, processes, or configuration
OFRAK benefits:
- No Source Code Required: Automatically apply security enhancements directly to firmware binaries without slowing the development cycle
- Save Engineering Time: Leverage advanced embedded security experts instead of trying to develop a "roll your own" approach or keep ahead of threats with the constant treadmill of testing, patching and updating
- Defend From Within: Benefit from a competitive advantage, reduction of liability, and alignment with your brand image
For more information on OFRAK, visit https://ofrak.com/.
For more information on Red Balloon Security, visit https://www.redballoonsecurity.com/.
About Red Balloon Security
Founded in 2011, Red Balloon Security is a leading cybersecurity provider and research firm that specializes in the protection of embedded devices across all industries. Red Balloon Security's pioneering R&D is led by a team of world-class academic researchers and developers who have published seminal research papers in the fields of embedded security and intrusion detection, led U.S. Department of Defense-funded research activities, worked closely with Fortune 500 companies, ethically disclosed vulnerabilities within hundreds of millions of ubiquitous embedded devices, and worked as embedded security researchers within various intelligence agencies.
Media Contact
David Libby, Red Balloon Security, 1 415-518-6611, [email protected] , https://redballoonsecurity.com/
SOURCE Red Balloon Security
Share this article